* chore: release engine-v1.16.0 + dagster-v1.12.0 + vscode-v1.8.0

Bundles the governance waveplan — five merged PRs (#240 audit trail,
#241 classification + masking, #242 rocky compliance, #243 role-graph,
#244 retention) on top of three FR-004 / state-path follow-ups
(#237 error-path idempotency, #238 state-path unification,
#239 success-path idempotency finalize).

Version bumps: engine 1.15.0 → 1.16.0, dagster-rocky 1.11.0 → 1.12.0,
vscode extension 1.7.0 → 1.8.0.

CHANGELOGs updated for all three artifacts.

* chore(dagster): regen test fixtures for 1.16.0

Fixture drift flagged by CI (`codegen-drift.yml`). Fixtures are captured
from the live engine binary — the version-string bump to 1.16.0 ripples
through every `version` field, and the Wave A audit-trail work (#240)
adds the 8 `RunRecord` fields to `rocky history` output, which the
playground POC now emits.

Regenerated via `just regen-fixtures` against
`examples/playground/pocs/00-foundations/00-playground-default`.

* chore(scripts): sentinel top-level version field in fixture normaliser

Every CLI output's top-level `version` is `env!("CARGO_PKG_VERSION")`
at emit time, so every engine version bump rippled through all 38
captured fixtures — every release PR fought `codegen-drift.yml` until
`just regen-fixtures` was re-run.

Extend the existing `AUDIT_FIELD_SENTINELS` set (Wave A already
sentineled the audit-trail `rocky_version` field + hostname / git
commit / etc.) with the top-level `version` key → `"0.0.0-SENTINEL"`.
After this, version bumps only touch Cargo.toml / pyproject.toml /
package.json / CHANGELOGs — never fixtures.

Regen captured all 38 fixtures; top-level `version` now uniformly
renders as `"0.0.0-SENTINEL"`.

…ion actions (#251)

Closes the `--env <name>` plumbing gap left over from the 1.16.0 governance
waveplan: `RockyConfig::resolve_mask_for_env(Option<&str>)` already accepted
an env, but `rocky run` / `rocky plan` hard-coded `None`. This wires the flag
through on both commands so `[mask.<env>]` overrides resolve over the
workspace `[mask]` defaults, matching the `--env` shape `rocky compliance`
already uses.

`PlanOutput` gains three additive action-row collections — a dry-run view of
the control-plane governance work the post-DAG reconcile pass in `rocky run`
would do:

- `classification_actions`: `(model, column, tag)` triples from
  `[classification]` sidecars.
- `mask_actions`: `(model, column, tag, resolved_strategy)` where the tag
  resolves under the active env; unresolved tags are a `rocky compliance`
  diagnostic, not a preview row.
- `retention_actions`: models with `retention = "<N>[dy]"` sidecar, carrying
  the parsed `duration_days` + a warehouse-native `warehouse_preview`
  (Databricks renders the Delta TBLPROPERTIES pair; Snowflake renders
  `DATA_RETENTION_TIME_IN_DAYS`; other adapters emit `null`).

All three fields use `skip_serializing_if = "Vec::is_empty"` so existing JSON
consumers on projects without governance config are byte-stable. `PlanOutput.env`
carries the active `--env` under the same treatment.

Role-graph reconcile stays env-invariant. `rocky.toml` has no `[role.<env>]`
override shape (contrast `[mask.<env>]`); roles represent deployment-wide
permission groups while masks vary per env. `--env` therefore does NOT flow
into `reconcile_role_graph`. Classification tagging and retention policies
are also env-invariant by the same reasoning.

Regenerated bindings via `just codegen`:
- `schemas/plan.schema.json`
- `integrations/dagster/src/dagster_rocky/types_generated/plan_schema.py`
- `editors/vscode/src/types/generated/plan.ts`

Dagster `PlanResult` hand-written model picks up the four new fields
(`env`, `classification_actions`, `mask_actions`, `retention_actions`) and
re-exports `ClassificationAction` / `MaskAction` / `RetentionAction` from
the package barrel. New `PLAN_WITH_GOVERNANCE` scenario + `plan_with_governance_json`
fixture + `test_parse_plan_with_governance` parse-guard.

Follow-up of the governance waveplan shipped in engine-v1.16.0 (#241, #243, #244).

…le-graph reconciliation (#254)

Completes the Wave C-1 role-graph reconciler that shipped log-only in
#243. The v1 impl validated role names and emitted `debug!` but never
created UC groups or emitted grants — this wires both pieces up so
`reconcile_role_graph` becomes real.

New `rocky_databricks::scim` module wraps the workspace-level
`/api/2.0/preview/scim/v2/Groups` surface:

- `create_group(display_name)` — POSTs with SCIM 2.0 `schemas` envelope;
  idempotent via POST-first / 409-fallback-to-GET-by-displayName.
- `get_group_by_name(display_name)` — filter lookup.
- `delete_group` deferred (ADD-ONLY v1 scope).

Reuses the existing `Auth` stack (PAT + OAuth M2M) — no new auth path.

`DatabricksGovernanceAdapter::reconcile_role_graph` now:

1. Creates a `rocky_role_<name>` group per role via SCIM (catalog-
   independent, once per role).
2. Emits `GRANT <permission> ON CATALOG <catalog> TO
   `rocky_role_<name>`` per `(role, catalog, permission)` triple
   against every catalog the current `rocky run` touched.

Trait signature change: `GovernanceAdapter::reconcile_role_graph` gains
a `catalogs: &[&str]` parameter (Option A). Keeps SCIM creates outside
the catalog loop — avoids N× redundant round-trips that Option B
(per-catalog calls from the caller) would force. In-process trait only;
no JSON / FFI / bindings surface to regenerate. `run.rs` collects
managed catalogs unconditionally — not gated on `auto_create_catalogs`,
so pre-provisioned catalogs are covered.

ADD-ONLY semantics: groups are never deleted and grants are never
revoked by this path. A role removed from rocky.toml leaves its group
and grants in place until a future reconcile mode adds delete. Adapters
constructed via `without_workspace()` (no SCIM client) fall back to
the v1 log-only behaviour.

Tests: SCIM unit tests (URL / body serialization / response parsing)
plus wiremock end-to-end covering happy-path create (201), idempotent
409 → GET fallback, 2 roles × 2 catalogs with varied permissions (2
SCIM creates + 6 GRANTs), empty-catalogs (SCIM fires, zero GRANTs),
empty-roles no-op, and the log-only fallback when SCIM isn't
configured.